TLPBLACK
Boulder, CO
Joined August 2010
- Tweets15.6K
- Following1.4K
- Followers7.1K
- Likes10.2K
Kurt Baumgartner retweeted
Everyone considering a professional career in security research, RE, and Malware Analysis needs to know YARA Rules.
YARA Rules are used throughout the industry next to STIX 2.1 Standard to classify and identify malware.
It's in essence, pattern matching utilizing static signatures from strings, IOC's and other unique identifiers close to functionality as possible. You can't use the digest/hash on a family that mutates with new variants and forks every week so YARA fixes that problem.
I encourage you to get familiar and read the docs which I will link below. I write YARA rules for every analysis I conduct and I post on openbin.ai
yara.readthedocs.io/en/stabl…
#cybersecurity
#malware
#reverseengineering
#malwareanalysis
"Ollama, vLLM, all the homegrown agent stuff people are exposing without thinking too hard about it - are a genuinely new kind of thing to attack" <-- marco reviews a night time #ai_hacking visit
tlpblack.net/blog/20260804-h…
Cymru recently posted addresses related to interesting infra with history - our TLPBLACK sensors tracked attacks from some of these IP going back to august 2025
Self-hosted AI-quota gateways are showing up as live attack infrastructure. We're currently tracking 241 IPs running New API and Sub2API panels (gen-ai:new-api / gen-ai:sub2api) that double as C2, recon, and proxy nodes across 46 ASNs in Hong Kong, the US, Singapore, and China.
C2 controllers:
103.194.106.229 cyberstrikeai + new-api
185.242.235.16 cyberstrikeai + overlord-rat + new-api
66.154.108.173 adaptixc2 + proxy:nps + new-api
101.37.210.236 supershell + sub2api
35.78.107.61 adaptixc2 + sub2api
Recon + offensive-sec tooling:
124.222.164.176 ost:arl + new-api + openclaw
152.32.252.32 ost:arl + new-api
38.76.169.125 ost:gophish + new-api
FRP tunnels + brute-force:
183.250.89.44 proxy:frp + scanner:brute-force + new-api
38.148.249.2 proxy:frp + scanner:brute-force + new-api
45.145.228.130 proxy:frp + new-api
Kurt Baumgartner retweeted
This is the best visualisation of just how massive and expansive the Epstein network of people and organisations is.
epsteinsecrets.com/network?n…
Kurt Baumgartner retweeted
Two U.S. Nationals Sentenced for Facilitating Fraudulent Remote Information Technology Worker Scheme that Generated $5M in Revenue for the Democratic People’s Republic of Korea
“For years, the defendants enriched themselves by assisting North Korean actors in a fraudulent scheme to gain employment with U.S. companies,” said Assistant Attorney General for National Security John A. Eisenberg. “The ruse placed North Korean IT workers on the payrolls of unwitting U.S. companies and in U.S. computer systems, thereby harming our national security. NSD will hold accountable those who facilitate North Korea’s illicit revenue generation efforts.”
🔗: justice.gov/opa/pr/two-us-na…
filed under harvard law professors that cant read...
av: i take the first sentence, especially when i stick my own words in it, to become something of my making, and completely out of place from the rest of the text that follows by the writer.
Kurt Baumgartner retweeted
BREAKING: You checked the weather this morning.
And you just told a surveillance company where you sleep.
Meet #Webloc, used by ICE, cops & foreign govs to track 500m+ phones.
No warrant required.
Our latest @citizenlab investigation + how to protect yourself 🧵/1
Kurt Baumgartner retweeted
The @FBI has identified cyber actors associated with Russian Intelligence Services targeting users of commercial messaging applications, including Signal.
The campaign targets individuals of high intelligence value, including current and former U.S. government officials, military personnel, political figures, and journalists.
Globally, this effort has resulted in unauthorized access to thousands of individual accounts. After gaining access, the actors can view messages and contact lists, send messages as the victim, and conduct additional phishing from a trusted identity.
It's important for you to be aware and take action - this vulnerability is not with the application - but you as the end user.
The FBI and CISA have released a joint PSA to help you identify this activity and protect your accounts: ic3.gov/PSA/2026/PSA260320
Kurt Baumgartner retweeted
Today the Danish Defence Intelligence Service attributed two cyberattacks to Russia. We strongly condemn these attacks against a Danish water utility and Danish websites during elections in DK. We call on Russia to cease these malicious cyber activities
fe-ddis.dk/globalassets/fe/d…
his shaihulud-infected package has ~700k weekly downloads. what is the shell-exec package used for?
socket.dev/npm/package/shell…
Kurt Baumgartner retweeted
It’s been a while since I read a good blog post about WiFi hacking tricks. The hack does not necessarily have to be complex to work.
Really great blogpost about bypassing client isolation on wifi networks (WPA till 2 and public) from Ben Knight pulsesecurity.co.nz/articles…
Kurt Baumgartner retweeted
Well, that was nuts!
Thank you to all of our speakers, staff, sponsors, and guests who made the inaugural 🆘 a smashing success and deepened the vibe. We hope you had as much fun as we did.
Au revoir?
Kurt Baumgartner retweeted
On the pod, Dave Aitel reacts to a L3Harris Trenchant exec pleading guilty to selling exploits to Russian brokers @daveaitel
Kurt Baumgartner retweeted
We’re excited to announce that The Vertex Project (@vtxproject) is a sponsor of State of Statecraft 2025. Their generous support helps make our event possible.
The Vertex Project creates technology for analytical teams to provide intelligence-driven insights to decision makers.
Check out their website vertex.link to learn more and join us in thanking them for their support! 🙌
#what_is_sos #VertexProject #VertexSynapse
Kurt Baumgartner retweeted
State of Statecraft (SOS) is a new security and intelligence conference purposed to bring together observers of espionage, sabotage, influence, and other unique forms of covert statecraft to share their work with a community hyper-focused on tackling state-sponsored ops.
Kurt Baumgartner retweeted
A Chinese cyberespionage actor was arrested in Italy over the holiday and faces extradition to the US. The crew he's connected to is pretty serious. reuters.com/world/china/ital…
hey folks, you'll find me where the skies are blue, as "kurtisj".
more open source and real free speech, much less trash